Can an OpenVPN client be used as a default gateway for another OpenVPN client?

Need help configuring your VPN? Just post here and you'll get that help.
Forum rules
Please use the [oconf] BB tag for openvpn Configurations. See viewtopic.php?f=30&t=21589 for an example.
Post Reply
Kei
OpenVpn Newbie
Posts: 3
Joined: Sat Nov 10, 2018 10:51 am

Can an OpenVPN client be used as a default gateway for another OpenVPN client?

Post by Kei » Sat Nov 10, 2018 11:25 am

Hello,

I'm using OpenVPN since many years and I think I'm quite familiar with OpenVPN and it's configuration.

Currently I'm trying to use an openvpn client as a default gateway for another openvpn client in the same (openvpn) network (topology subnet). I tried to get this up and running with "client-to-client", without "client-to-client" and normal routing and without "client-to-client" together with policy based routing at the server side. None of these tries were successful. The last try is the reason for my question:

Is it possible (in general) to implement this? An if so, can somebody give me a hint how to do so?

I'm asking because of the current result of the policy based routing, which shows the problem much more clear than the other scenarios:

1. The routing tables of the clients and the server are correct (verified with ip route list, ip route get ... and so on)

2. The clients can reach each other (verified with ping).

3. The server can reach the clients (verified with ping)

4. If the first openvpn client try to ping another system on the internet using using its default gateway (the openvpn server which should choose the second openvpn client as a default route because of the policy based routing I configured), the tun0 device of the openvpn server show the correct traffic (incoming tun0, outgoing tun0), but the second client shows no incoming traffic (tcpdump -i tun0).

Man thanks in advance,

Kei

Kei
OpenVpn Newbie
Posts: 3
Joined: Sat Nov 10, 2018 10:51 am

Re: Can an OpenVPN client be used as a default gateway for another OpenVPN client?

Post by Kei » Thu Nov 22, 2018 8:51 am

I got it up and running. :D

As often, a small configuration mistake caused the problem. Hence I can answer my question now: It is possible to use an openvpn client as a default gateway for another openvpn client in the same openvpn network ("topology subnet") - at least under linux.

I'll try to summarize the solution.

0. Prerequisites
OpenVPN network: 192.168.100.0/24
OpenVPN server: 192.168.100.1/32
OpenVPN client 1: 192.168.100.200
OpenVPN client 2: 192.168.100.254

The public ip addresses don't matter.

The openvpn server is used as the default gateway for the clients as usual.

The openvpn server is NOT using "client-to-client".

Client 1 should uses client 2 as default gateway.

1. Setup kernel routing table(s) on the server side
a) echo "200 vpnclient" > > /etc/iproute2/rt_tables
b) ip route add 192.168.100.0/24 dev tun0 src 192.168.100.1 table vpnclient
c) ip route add default via 192.168.100.254 dev tun0 table vpnclient
d) ip rule add from 192.168.100.200/32 table vpnclient
e) ip rule add to 192.168.100.200/32 table vpnclient
f) ip route flush cache

"b" to "f" have to been executed on every start of the system, "a" only once.

2. Use individual client configurations (client-config-dir)
a) Client 1
[oconf=/etc/openvpn/ccd/client1]
push "topology subnet"

# Set a static ip address for this client
ifconfig-push 192.168.100.200 255.255.255.0
[/oconf]

b) Client 2
[oconf=/etc/openvpn/ccd/client2]

# Don't set the default route to the openvpn server
# (this client should act as a gateway for another openvpn client)
push-reset

push "topology subnet"

# Set a static ip address for this client
ifconfig-push 192.168.100.254 255.255.255.0

iroute 0.0.0.0 0.0.0.0
[/oconf]

That's it. Of course, there are other things that have to be configured i. e.
- IP forwarding has to be enabled on Client 2 (and on the openvpn server, too)
- Client 2 needs an additional iptables rule like "iptables -t nat -A PREROUTING -o eth+ -s 192.168.100.200 -j MASQUERADE" because the client will send out the traffic to the internet.
- ...

Hope this helps.

Post Reply